Resubmissions

25-01-2021 18:42

210125-r1hfrr5jc6 10

19-01-2021 19:41

210119-88n6rsk2w6 10

Analysis

  • max time kernel
    150s
  • max time network
    104s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    25-01-2021 18:42

General

  • Target

    CFDI__Manager__12365.exe

  • Size

    809KB

  • MD5

    5b7c3ff3556606c67a61527f81579eee

  • SHA1

    75299ed8a21eebe1b1969e065e80f02ad21d4267

  • SHA256

    82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f

  • SHA512

    6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 116 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
    "C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
      "C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"
      2⤵
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: MapViewOfSection
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5056
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Modifies firewall policy service
        • Checks BIOS information in registry
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:792
        • C:\Users\Admin\AppData\Local\Temp\13773ik9_1.exe
          /suac
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:380
        • C:\Users\Admin\AppData\Local\Temp\umy1e759eek3.exe
          "C:\Users\Admin\AppData\Local\Temp\umy1e759eek3.exe"
          4⤵
          • Executes dropped EXE
          PID:1080
        • C:\Users\Admin\AppData\Local\Temp\s5uks1k73q.exe
          "C:\Users\Admin\AppData\Local\Temp\s5uks1k73q.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1316
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2060
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2264
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\Google Updater 2.09\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2528
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2568

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    MD5

    ad5cd538ca58cb28ede39c108acb5785

    SHA1

    1ae910026f3dbe90ed025e9e96ead2b5399be877

    SHA256

    c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

    SHA512

    c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    90e605c7715d0176aad22e2998b7e553

    SHA1

    3a47d8979bae208b9c8d29f97d27a3c04cfd089e

    SHA256

    26c9324f65b72c1f04e06a7b2781a1e1d9d0344e210af0b08d3549658fb76bc7

    SHA512

    b0b201d63859e8b5bbdbf3048e33ce833a757e8065f31e6be35ff153eedcc06745935e491bf4589710f9e7ae312bd9f4523d81502b5e34b5f66cbec927795639

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    005002555db0bf03ff21848ee947aba3

    SHA1

    e3611a788bf54a9a3b4d0207fb01918d9fbccb19

    SHA256

    d495bd3dc404c98a5423d418f4203f1a4fa02e666db8f686f28abaa896e2e5cb

    SHA512

    5978674700e56fe65f4c2da82b9bd8bf4e8174b4031ccf7e31fc494771046915622d2486a83b52475d97943e2b380b5af9257a48b1a2fb6654c9c0e5890d9787

  • C:\Users\Admin\AppData\Local\Temp\13773ik9_1.exe

    MD5

    5b7c3ff3556606c67a61527f81579eee

    SHA1

    75299ed8a21eebe1b1969e065e80f02ad21d4267

    SHA256

    82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f

    SHA512

    6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

  • C:\Users\Admin\AppData\Local\Temp\13773ik9_1.exe

    MD5

    5b7c3ff3556606c67a61527f81579eee

    SHA1

    75299ed8a21eebe1b1969e065e80f02ad21d4267

    SHA256

    82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f

    SHA512

    6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

  • C:\Users\Admin\AppData\Local\Temp\s5uks1k73q.exe

    MD5

    4fd50d4173e873a52e7841fe2a3f921e

    SHA1

    4ffd734a7877f78fdf2b65b37e90b2db3be20fe3

    SHA256

    456b6497adb103204e78b1888c75cc73a6e61e8aa1d5eec27eb594f98e0601ed

    SHA512

    5c272aeb5a27d905251d4e41216d69060eebe2d978602f339776486bbb007ea294183921a7c57c8a8dafaf50080df08b411f45610dfebd6a61d7dc28658d8ab0

  • C:\Users\Admin\AppData\Local\Temp\s5uks1k73q.exe

    MD5

    4fd50d4173e873a52e7841fe2a3f921e

    SHA1

    4ffd734a7877f78fdf2b65b37e90b2db3be20fe3

    SHA256

    456b6497adb103204e78b1888c75cc73a6e61e8aa1d5eec27eb594f98e0601ed

    SHA512

    5c272aeb5a27d905251d4e41216d69060eebe2d978602f339776486bbb007ea294183921a7c57c8a8dafaf50080df08b411f45610dfebd6a61d7dc28658d8ab0

  • C:\Users\Admin\AppData\Local\Temp\umy1e759eek3.exe

    MD5

    dc9127dc898edcb166176abfc891ee59

    SHA1

    400466e887170c260628143430d08335a88d5298

    SHA256

    4490550a55d971b2305d209e9a9d6fdb4954fb1c4c435d0b1f4e98d84a938074

    SHA512

    85347b252c34c39b8781a592af94de66dc65908c8d2c92a447cc8fca4996eea65e4c0875f891c9372ff51873c05894f846d9e37e965959f4c5c5d0367e0afb4c

  • C:\Users\Admin\AppData\Local\Temp\umy1e759eek3.exe

    MD5

    dc9127dc898edcb166176abfc891ee59

    SHA1

    400466e887170c260628143430d08335a88d5298

    SHA256

    4490550a55d971b2305d209e9a9d6fdb4954fb1c4c435d0b1f4e98d84a938074

    SHA512

    85347b252c34c39b8781a592af94de66dc65908c8d2c92a447cc8fca4996eea65e4c0875f891c9372ff51873c05894f846d9e37e965959f4c5c5d0367e0afb4c

  • memory/380-18-0x0000000000000000-mapping.dmp

  • memory/792-10-0x0000000000C90000-0x00000000010D0000-memory.dmp

    Filesize

    4.2MB

  • memory/792-11-0x0000000003400000-0x0000000003534000-memory.dmp

    Filesize

    1.2MB

  • memory/792-15-0x00000000031E0000-0x00000000031E1000-memory.dmp

    Filesize

    4KB

  • memory/792-17-0x0000000004C40000-0x0000000004C42000-memory.dmp

    Filesize

    8KB

  • memory/792-7-0x0000000000000000-mapping.dmp

  • memory/1080-24-0x0000000071A20000-0x000000007210E000-memory.dmp

    Filesize

    6.9MB

  • memory/1080-21-0x0000000000000000-mapping.dmp

  • memory/1080-25-0x0000000000E20000-0x0000000000E21000-memory.dmp

    Filesize

    4KB

  • memory/1316-27-0x0000000000000000-mapping.dmp

  • memory/2060-46-0x000001A01C483000-0x000001A01C485000-memory.dmp

    Filesize

    8KB

  • memory/2060-36-0x00007FFAEE530000-0x00007FFAEEF1C000-memory.dmp

    Filesize

    9.9MB

  • memory/2060-55-0x000001A01C486000-0x000001A01C488000-memory.dmp

    Filesize

    8KB

  • memory/2060-64-0x000001A01C488000-0x000001A01C489000-memory.dmp

    Filesize

    4KB

  • memory/2060-32-0x0000000000000000-mapping.dmp

  • memory/2060-44-0x000001A01C480000-0x000001A01C482000-memory.dmp

    Filesize

    8KB

  • memory/2060-42-0x000001A036A60000-0x000001A036A61000-memory.dmp

    Filesize

    4KB

  • memory/2060-40-0x000001A01C440000-0x000001A01C441000-memory.dmp

    Filesize

    4KB

  • memory/2264-37-0x00007FFAEE530000-0x00007FFAEEF1C000-memory.dmp

    Filesize

    9.9MB

  • memory/2264-33-0x0000000000000000-mapping.dmp

  • memory/2264-63-0x000001DAF2628000-0x000001DAF2629000-memory.dmp

    Filesize

    4KB

  • memory/2264-45-0x000001DAF2620000-0x000001DAF2622000-memory.dmp

    Filesize

    8KB

  • memory/2264-57-0x000001DAF2626000-0x000001DAF2628000-memory.dmp

    Filesize

    8KB

  • memory/2264-50-0x000001DAF2623000-0x000001DAF2625000-memory.dmp

    Filesize

    8KB

  • memory/2528-56-0x000001EDF1F26000-0x000001EDF1F28000-memory.dmp

    Filesize

    8KB

  • memory/2528-38-0x00007FFAEE530000-0x00007FFAEEF1C000-memory.dmp

    Filesize

    9.9MB

  • memory/2528-66-0x000001EDF1F28000-0x000001EDF1F29000-memory.dmp

    Filesize

    4KB

  • memory/2528-34-0x0000000000000000-mapping.dmp

  • memory/2528-47-0x000001EDF1F20000-0x000001EDF1F22000-memory.dmp

    Filesize

    8KB

  • memory/2528-48-0x000001EDF1F23000-0x000001EDF1F25000-memory.dmp

    Filesize

    8KB

  • memory/2568-53-0x000001FEB9633000-0x000001FEB9635000-memory.dmp

    Filesize

    8KB

  • memory/2568-51-0x000001FEB9630000-0x000001FEB9632000-memory.dmp

    Filesize

    8KB

  • memory/2568-59-0x000001FEB9636000-0x000001FEB9638000-memory.dmp

    Filesize

    8KB

  • memory/2568-35-0x0000000000000000-mapping.dmp

  • memory/2568-65-0x000001FEB9638000-0x000001FEB9639000-memory.dmp

    Filesize

    4KB

  • memory/2568-39-0x00007FFAEE530000-0x00007FFAEEF1C000-memory.dmp

    Filesize

    9.9MB

  • memory/5056-2-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/5056-8-0x0000000000A50000-0x0000000000A51000-memory.dmp

    Filesize

    4KB

  • memory/5056-9-0x0000000002670000-0x000000000267C000-memory.dmp

    Filesize

    48KB

  • memory/5056-6-0x00000000005B0000-0x00000000005BD000-memory.dmp

    Filesize

    52KB

  • memory/5056-5-0x00000000009A0000-0x0000000000A06000-memory.dmp

    Filesize

    408KB

  • memory/5056-4-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/5056-3-0x00000000004015C6-mapping.dmp